Data Protection Commissioner

A retail company sought advice from my Office on the extension of its loyalty card scheme to a new outlet. In the normal course of events, customers become members of the loyalty card scheme by making an application at any of the company’s retail outlets. It was now proposed to write to potential customers in the catchment area of the new outlet, using a purchased mailing list, inviting them to join the loyalty card scheme. It was further proposed to enclose a loyalty card with the letters of invitation. Use of the card would automatically enrol the potential customers in the loyalty card scheme, with their names being transferred from the mailing list database to the loyalty card membership database.

The main data protection question which arose was whether the triggering of automatic membership of the loyalty card scheme by simply using the card constituted consent to membership by the customer and fair obtaining by the company of the customers’ personal data. In particular, I was concerned that a card sent through the post to one member of a household might be used by another member of the household, thus enrolling the first household member in the scheme, possibly without consent. I was of the view that for the scheme to operate as the company envisaged, it would be necessary, when issuing the invitations, to make the implications of the use of the card very clear and to give people a clear opt-out.

In the event, the company agreed to include in the invitation letter a prominent and clear statement that if customers used the loyalty card, their names and addresses would be recorded by the company as part of the loyalty-club membership; and that, if a customer did not wish to become a club member, the card should be destroyed. Given the clear statement of the effect of using the card, the warning to destroy the card if one did not wish to become a member and the prominence given to the statement in the invitation letter, I was satisfied that the automatic triggering of membership by use of the card could, in these particular circumstances, indicate clear consent and thus fair obtaining for the purposes of the Data Protection Act.